CVE-2024-29651: json-schema-ref-parser RCE Vulnerability

CVE-2024-29651 Overview

CVE-2024-29651 is a prototype pollution vulnerability in the API Dev Tools json-schema-ref-parser library, affecting versions 11.0.0 and 11.1.0. The flaw resides in the bundle(), parse(), resolve(), and dereference() functions. A remote attacker can supply a crafted JSON schema that pollutes the Object.prototype chain, leading to arbitrary code execution in the host Node.js application. The weakness is categorized under [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes).

Critical Impact
Successful exploitation allows remote attackers to execute arbitrary code in any Node.js service that parses untrusted JSON Schema documents through the affected library.

Affected Products

API Dev Tools json-schema-ref-parser version 11.0.0
API Dev Tools json-schema-ref-parser version 11.1.0
Downstream Node.js applications and tooling that consume these versions as a dependency

Discovery Timeline

2024-05-20 - CVE-2024-29651 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29651

Vulnerability Analysis

The json-schema-ref-parser library resolves $ref pointers across JSON Schema documents and merges referenced content into a single in-memory object graph. During this merge, the affected versions recursively copy keys from attacker-supplied input without filtering reserved property names such as __proto__, constructor, or prototype. When the library walks a malicious schema, the assignment reaches Object.prototype, mutating properties inherited by every object in the running process.

The four entry points bundle(), parse(), resolve(), and dereference() all funnel input through the vulnerable merge routine. Any consumer that accepts external schema URLs, uploaded schema files, or schemas embedded in API requests becomes an exposure path. Because the polluted prototype affects unrelated code paths, attackers can chain the primitive into gadget-based remote code execution depending on the host application's behavior.

Root Cause

The root cause is unsafe recursive property assignment during reference resolution. The library treats all object keys as data, including keys that traverse the prototype chain. The absence of an allow-list or Object.create(null) containers permits writes to __proto__.<key>, persisting attacker-controlled values globally.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker submits a JSON Schema containing crafted __proto__ keys to any endpoint that hands the document to parse(), bundle(), resolve(), or dereference(). After pollution, subsequent property lookups across the application return attacker-controlled values, which can hijack templating engines, child process options, or library configuration to achieve code execution. Technical details are documented in the public GitHub Gist proof of concept.

Detection Methods for CVE-2024-29651

Indicators of Compromise

Inbound HTTP payloads or stored JSON Schema files containing the literal keys __proto__, constructor.prototype, or prototype nested inside schema definitions.
Node.js processes spawning unexpected child processes such as sh, bash, or cmd.exe immediately after schema parsing operations.
Application logs showing parsing errors from json-schema-ref-parser followed by anomalous outbound network connections.

Detection Strategies

Inspect application dependency manifests (package.json, package-lock.json, yarn.lock) for json-schema-ref-parser@11.0.0 or 11.1.0.
Enable Node.js runtime monitoring to flag writes to Object.prototype during request handling.
Apply WAF or API gateway rules that reject JSON bodies containing __proto__ or constructor keys when targeting schema-processing endpoints.

Monitoring Recommendations

Forward Node.js process telemetry, including child process creation and outbound connections, to a centralized analytics platform for correlation.
Alert on parser exceptions originating from json-schema-ref-parser correlated with subsequent privilege-sensitive operations.
Track Software Bill of Materials (SBOM) drift to identify reintroduction of vulnerable versions through transitive dependencies.

How to Mitigate CVE-2024-29651

Immediate Actions Required

Inventory all Node.js services and audit package-lock.json for json-schema-ref-parser versions 11.0.0 and 11.1.0, including transitive usage by libraries such as Swagger and OpenAPI tooling.
Upgrade json-schema-ref-parser to a fixed release beyond 11.1.0 and rebuild affected container images.
Validate and sanitize JSON inputs at the API boundary, rejecting payloads containing __proto__, constructor, or prototype keys.

Patch Information

Upgrade json-schema-ref-parser to a version later than 11.1.0. Consult the project's release notes and the referenced GitHub Gist for technical context on the underlying issue. Rebuild and redeploy every downstream artifact that pinned the vulnerable range.

Workarounds

Run Node.js applications with --disable-proto=delete to neutralize the __proto__ accessor as a defense-in-depth control.
Wrap calls to parse(), bundle(), resolve(), and dereference() with input sanitizers that strip dangerous keys before invocation.
Freeze critical prototypes at process startup using Object.freeze(Object.prototype) where application compatibility permits.

bash

# Configuration example
npm ls json-schema-ref-parser
npm update json-schema-ref-parser
node --disable-proto=delete app.js